CVE-2026-57146— PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体团队系统。在版本 4.5.115 至 4.6.61（不含）之间，已发布的 A2U 安全公告 GHSA-f292-66h9-fpmf 声称未经验证的 A2U 事件流问题已在 praisonai 4.5.115 中修复。然而，当前代码主干在操作者启动文档中指定的 CLI 入口点时，仍会暴露相同的 A2U 订阅和事件路由，且未实施身份验证。当前的 CLI 包装器既未暴露 参数，也未安装通用的 API 密钥中间件，同时未为 A2U 生成令牌。该包装器直接调用 。此辅助函数仅在 环境变量已存
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57146
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.5.115, < 4.6.61 | - |
|
II. Public POCs for CVE-2026-57146
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57146
请登录查看更多情报信息。
Other References for CVE-2026-57146 (1)
Same Patch Batch · MervinPraison · 2026-10-23 · 16 CVEs total
| CVE-2026-57116 | 9.8 CRITICAL | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remo |
| CVE-2026-56832 | 8.8 HIGH | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals |
| CVE-2026-56840 | 8.8 HIGH | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-pa |
| CVE-2026-57117 | 8.8 HIGH | PraisonAI: Compute-bridged file tools allow shell command injection |
| CVE-2026-57144 | 8.8 HIGH | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is |
| CVE-2026-56837 | 8.6 HIGH | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56835 | 8.3 HIGH | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-56836 | 8.2 HIGH | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard |
| CVE-2026-57113 | 8.1 HIGH | PraisonAI GitHub template cache path traversal allows outside-cache file write and directo |
| CVE-2026-57121 | 8.1 HIGH | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' co |
| CVE-2026-56838 | 7.8 HIGH | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement |
| CVE-2026-57142 | 7.8 HIGH | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous |
| CVE-2026-56833 | 7.5 HIGH | PraisonAI Dynamic Context history and terminal tools read files outside configured storage |
| CVE-2026-56834 | 7.5 HIGH | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storag |
| CVE-2026-57114 | 7.2 HIGH | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow -
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 p
Same vendor: MervinPraison
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow -
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 p
Same weakness: CWE-200
-
CVE-2026-55826
Customer Order Data Exposed via Unauthenticated gtm_server_s -
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 p -
CVE-2026-115449
Libslirp: libslirp: icmp echo reply length desynchronization -
CVE-2026-114657
Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via -
CVE-2026-114574
massCodeIO massCode Local HTTP Service index.ts information
V. Comments for CVE-2026-57146
No comments yet